Merge branch 'main' into utf8-substring

.docker/prod.Dockerfile

@@ -2,16 +2,22 @@ ARG VERSION=edge
 ARG GVM_LIBS_VERSION=oldstable
 ARG DEBIAN_FRONTEND=noninteractive
 ARG IMAGE_REGISTRY=ghcr.io
+# when set it will added to the cmake command
+# As an example:
+# FEATURE_TOGGLES="-DOPENVASD=1"
+# enables openvasd feature toggle.
+ARG FEATURE_TOGGLE=""
 
 FROM ${IMAGE_REGISTRY}/greenbone/gvmd-build:${VERSION} as builder
+ARG FEATURE_TOGGLE
 
 COPY . /source
 WORKDIR /source
 
 RUN mkdir /build && \
     mkdir /install && \
     cd /build && \
-    cmake -DCMAKE_BUILD_TYPE=Release /source && \
+    cmake -DCMAKE_BUILD_TYPE=Release $FEATURE_TOGGLE /source && \
     make DESTDIR=/install install
 
 FROM greenbone/gvm-libs:${GVM_LIBS_VERSION}

.github/workflows/container.yml

@@ -14,6 +14,11 @@ jobs:
   images:
     name: Production Images
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        build:
+          - default
+          - openvasd
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -41,8 +46,9 @@ jobs:
             type=ref,event=pr
 
             # when a new git tag is created set stable and a latest tags
-            type=raw,value=latest,enable=${{ steps.latest.outputs.is-latest-tag == 'true' }}
-            type=raw,value=stable,enable=${{ steps.latest.outputs.is-latest-tag == 'true' }}
+            type=raw,value=latest,enable=${{ steps.latest.outputs.is-latest-tag == 'true' && matrix.build == 'default'}}
+            type=raw,value=stable,enable=${{ steps.latest.outputs.is-latest-tag == 'true' && matrix.build == 'default'}}
+            type=raw,value=edge-openvasd,enable=${{ steps.latest.outputs.is-latest-tag == 'false' && matrix.build == 'openvasd' }}
       - name: Set container build options
         id: container-opts
         run: |
@@ -53,6 +59,11 @@ jobs:
             echo "version=edge" >> $GITHUB_OUTPUT
             echo "gvm-libs-version=oldstable-edge" >> $GITHUB_OUTPUT
           fi
+          if [[ "${{ matrix.build }}" = 'openvasd' ]]; then
+            echo 'ft=-DOPENVASD=1' >> $GITHUB_OUTPUT
+          else
+            echo 'ft=-DOPENVASD=0' >> $GITHUB_OUTPUT
+          fi
       - name: Login to Docker Registry
         if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
@@ -71,6 +82,7 @@ jobs:
           build-args: |
             VERSION=${{ steps.container-opts.outputs.version }}
             GVM_LIBS_VERSION=${{ steps.container-opts.outputs.gvm-libs-version }}
+            FEATURE_TOGGLE=${{ steps.container-opts.outputs.ft }}
             IMAGE_REGISTRY=${{ vars.IMAGE_REGISTRY }}
           file: .docker/prod.Dockerfile
           platforms: linux/amd64,linux/arm64

.github/workflows/push.yml

@@ -0,0 +1,58 @@
+name: Build and Push to Greenbone Registry
+
+on:
+  push:
+    branches: [ main ]
+    tags: ["v*"]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  building:
+    runs-on: self-hosted-generic
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - uses: greenbone/actions/is-latest-tag@v3
+        id: latest
+
+      - name: Set container build options
+        id: container-opts
+        run: |
+          if [[ "${{ github.ref_type }}" = 'tag' ]]; then
+            echo "version=stable" >> $GITHUB_OUTPUT
+            echo "gvm-libs-version=oldstable" >> $GITHUB_OUTPUT
+          else
+            echo "version=edge" >> $GITHUB_OUTPUT
+            echo "gvm-libs-version=oldstable-edge" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Build and Push Container
+        id: build-and-push
+        uses: greenbone/actions/container-build-push-generic@v3
+        with:
+          build-docker-file: .docker/prod.Dockerfile
+          build-args: |
+            VERSION=${{ steps.container-opts.outputs.version }}
+            GVM_LIBS_VERSION=${{ steps.container-opts.outputs.gvm-libs-version }}
+            IMAGE_REGISTRY=${{ vars.IMAGE_REGISTRY }}
+          cosign-key: ${{ secrets.COSIGN_KEY_OPENSIGHT }}
+          cosign-key-password: ${{ secrets.COSIGN_KEY_PASSWORD_OPENSIGHT }}
+          cosign-tlog-upload: "false"
+          image-url: community/gvmd
+          image-labels: |
+            org.opencontainers.image.vendor=Greenbone
+            org.opencontainers.image.base.name=greenbone/gvm-libs
+          image-tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=edge
+            type=ref,event=pr
+            type=raw,value=latest,enable=${{ steps.latest.outputs.is-latest-tag == 'true' }}
+            type=raw,value=stable,enable=${{ steps.latest.outputs.is-latest-tag == 'true' }}
+          registry: ${{ secrets.GREENBONE_REGISTRY }}
+          registry-username: ${{ secrets.GREENBONE_REGISTRY_USER }}
+          registry-password: ${{ secrets.GREENBONE_REGISTRY_TOKEN }}

CMakeLists.txt

@@ -101,7 +101,7 @@ include (CPack)
 
 ## Variables
 
-set (GVMD_DATABASE_VERSION 255)
+set (GVMD_DATABASE_VERSION 256)
 
 set (GVMD_SCAP_DATABASE_VERSION 21)
 
@@ -235,6 +235,11 @@ if (NOT GVM_DEFAULT_DROP_USER)
   set (GVM_DEFAULT_DROP_USER "")
 endif (NOT GVM_DEFAULT_DROP_USER)
 
+
+if (NOT OPENVASD)
+  set (OPENVASD 0)
+endif (NOT OPENVASD)
+
 message ("-- Install prefix: ${CMAKE_INSTALL_PREFIX}")
 
 ## Version
@@ -275,7 +280,7 @@ set (HARDENING_FLAGS            "-Wformat -Wformat-security -D_FORTIFY_SOURCE=2
 set (LINKER_HARDENING_FLAGS     "-Wl,-z,relro -Wl,-z,now")
 
 # To find unused functions, add: -flto -fwhole-program -ffunction-sections -Wl,--gc-sections -Wl,--print-gc-sections
-set (CMAKE_C_FLAGS              "${CMAKE_C_FLAGS} -Wall -D_BSD_SOURCE -D_ISOC99_SOURCE -D_SVID_SOURCE -D_DEFAULT_SOURCE -D_FILE_OFFSET_BITS=64")
+set (CMAKE_C_FLAGS              "${CMAKE_C_FLAGS} -Wall -D_BSD_SOURCE -D_ISOC99_SOURCE -D_SVID_SOURCE -D_DEFAULT_SOURCE -D_FILE_OFFSET_BITS=64 -DOPENVASD=${OPENVASD}")
 
 set (CMAKE_C_FLAGS_DEBUG        "${CMAKE_C_FLAGS_DEBUG} -Werror -Wshadow ${COVERAGE_FLAGS} ${DEBUG_FUNCTION_NAMES_FLAGS}")
 set (CMAKE_C_FLAGS_RELEASE      "${CMAKE_C_FLAGS_RELEASE} ${HARDENING_FLAGS} ${COVERAGE_FLAGS}")

src/CMakeLists.txt

@@ -27,10 +27,10 @@ find_package (Threads)
 ## might occur.
 
 pkg_check_modules (CJSON REQUIRED libcjson>=1.7.14)
-pkg_check_modules (LIBGVM_BASE REQUIRED libgvm_base>=22.9)
-pkg_check_modules (LIBGVM_UTIL REQUIRED libgvm_util>=22.9)
-pkg_check_modules (LIBGVM_OSP REQUIRED libgvm_osp>=22.9)
-pkg_check_modules (LIBGVM_GMP REQUIRED libgvm_gmp>=22.9)
+pkg_check_modules (LIBGVM_BASE REQUIRED libgvm_base>=22.10)
+pkg_check_modules (LIBGVM_UTIL REQUIRED libgvm_util>=22.10)
+pkg_check_modules (LIBGVM_OSP REQUIRED libgvm_osp>=22.10)
+pkg_check_modules (LIBGVM_GMP REQUIRED libgvm_gmp>=22.10)
 pkg_check_modules (GNUTLS REQUIRED gnutls>=3.2.15)
 pkg_check_modules (GLIB REQUIRED glib-2.0>=2.42)
 pkg_check_modules (LIBBSD REQUIRED libbsd)

src/gmp.c

@@ -12255,7 +12255,7 @@ handle_get_credentials (gmp_parser_t *gmp_parser, GError **error)
   SEND_GET_START("credential");
   while (1)
     {
-      const char *private_key, *public_key, *login, *type, *cert;
+      const char *login, *type, *cert;
       gchar *formats_xml;
 
       ret = get_next (&credentials, &get_credentials_data->get,
@@ -12269,8 +12269,6 @@ handle_get_credentials (gmp_parser_t *gmp_parser, GError **error)
         }
 
       SEND_GET_COMMON (credential, &get_credentials_data->get, &credentials);
-      private_key = credential_iterator_private_key (&credentials);
-      public_key = credential_iterator_public_key (&credentials);
       login = credential_iterator_login (&credentials);
       type = credential_iterator_type (&credentials);
       cert = credential_iterator_certificate (&credentials);
@@ -12349,6 +12347,10 @@ handle_get_credentials (gmp_parser_t *gmp_parser, GError **error)
 
           case CREDENTIAL_FORMAT_KEY:
             {
+              const char *public_key;
+
+              public_key = credential_iterator_public_key (&credentials);
+
               if (public_key && strcmp (public_key, ""))
                 {
                   SENDF_TO_CLIENT_OR_FAIL
@@ -12357,8 +12359,9 @@ handle_get_credentials (gmp_parser_t *gmp_parser, GError **error)
               else
                 {
                   char *pub;
-                  const char *pass;
+                  const char *pass, *private_key;
 
+                  private_key = credential_iterator_private_key (&credentials);
                   pass = credential_iterator_password (&credentials);
                   pub = gvm_ssh_public_from_private (private_key, pass);
                   SENDF_TO_CLIENT_OR_FAIL
@@ -18582,9 +18585,13 @@ handle_get_tasks (gmp_parser_t *gmp_parser, GError **error)
             auto_delete ? auto_delete : "0",
             auto_delete_data ? auto_delete_data : "0");
 
+          g_free (assets_apply_overrides);
+          g_free (assets_min_qod);
           g_free (in_assets);
           g_free (max_checks);
           g_free (max_hosts);
+          g_free (auto_delete);
+          g_free (auto_delete_data);
         }
 
       count++;
@@ -23419,6 +23426,7 @@ gmp_xml_handle_end_element (/* unused */ GMarkupParseContext* context,
                   log_event_fail ("user", "User", NULL, "created");
                   break;
                 case -3:
+                case -4:
                   SEND_TO_CLIENT_OR_FAIL (XML_ERROR_SYNTAX
                                           ("create_user", "Error in SOURCE"));
                   log_event_fail ("user", "User", NULL, "created");
@@ -26021,6 +26029,7 @@ gmp_xml_handle_end_element (/* unused */ GMarkupParseContext* context,
                                             ("modify_user", "Unknown role"));
                     break;
                   case -3:
+                  case -4:
                     SEND_TO_CLIENT_OR_FAIL (XML_ERROR_SYNTAX
                                             ("modify_user", "Error in SOURCES"));
                     break;

src/gmp_get.h

@@ -66,7 +66,6 @@ send_get_start (const char *, int (*) (const char *, void *), void *);
  * @brief Send start of GET response to client, returning on fail.
  *
  * @param[in]  type  Type of resource.
- * @param[in]  get   GET data.
  */
 #define SEND_GET_START(type)                               \
   do                                                       \

src/gvmd.c

@@ -2300,6 +2300,9 @@ gvmd (int argc, char** argv, char *env[])
           else
             printf ("Sentry support disabled\n");
         }
+#if OPENVASD == 1
+      printf ("OpenVASD is enabled\n");
+#endif
       printf ("Copyright (C) 2009-2021 Greenbone AG\n");
       printf ("License: AGPL-3.0-or-later\n");
       printf
@@ -2401,6 +2404,9 @@ gvmd (int argc, char** argv, char *env[])
       gvm_close_sentry ();
       exit (EXIT_FAILURE);
     }
+  else
+    set_log_tz ("utc 0");
+
   tzset ();
 
   /* Set umask to hoard created files, including the database. */
@@ -2484,6 +2490,7 @@ gvmd (int argc, char** argv, char *env[])
   /**
    * LDAP debugging
    */
+
   if (ldap_debug)
     {
       if (ldap_enable_debug () == 0)

src/lsc_crypt.c

@@ -581,6 +581,7 @@ lsc_crypt_release (lsc_crypt_ctx_t ctx)
   lsc_crypt_flush (ctx);
   if (ctx->encctx) /* Check required for gpgme < 1.3.1 */
     gpgme_release (ctx->encctx);
+  g_free (ctx->enckey_uid);
   g_free (ctx);
 }
 

src/manage.c

@@ -5085,6 +5085,8 @@ manage_sync (sigset_t *sigmask_current,
           wait_for_pid (scap_pid, "SCAP sync");
           wait_for_pid (cert_pid, "CERT sync");
 
+          update_scap_extra ();
+
           lockfile_unlock (&lockfile);
         }
     }
@@ -5977,6 +5979,54 @@ get_nvt_xml (iterator_t *nvts, int details, int pref_count,
           free (default_timeout);
         }
 
+      if (nvt_iterator_epss_cve (nvts))
+        {
+          buffer_xml_append_printf 
+             (buffer,
+              "<epss>"
+              "<max_severity>"
+              "<score>%0.5f</score>"
+              "<percentile>%0.5f</percentile>"
+              "<cve id=\"%s\">",
+              nvt_iterator_epss_score (nvts),
+              nvt_iterator_epss_percentile (nvts),
+              nvt_iterator_epss_cve (nvts));
+
+          if (nvt_iterator_has_epss_severity (nvts))
+            {
+              buffer_xml_append_printf 
+                 (buffer,
+                  "<severity>%0.1f</severity>",
+                  nvt_iterator_epss_severity (nvts));
+            }
+
+          buffer_xml_append_printf
+             (buffer,
+              "</cve>"
+              "</max_severity>"
+              "<max_epss>"
+              "<score>%0.5f</score>"
+              "<percentile>%0.5f</percentile>"
+              "<cve id=\"%s\">",
+              nvt_iterator_max_epss_score (nvts),
+              nvt_iterator_max_epss_percentile (nvts),
+              nvt_iterator_max_epss_cve (nvts));
+
+          if (nvt_iterator_has_max_epss_severity (nvts))
+            {
+              buffer_xml_append_printf 
+                 (buffer,
+                  "<severity>%0.1f</severity>",
+                  nvt_iterator_max_epss_severity (nvts));
+            }
+
+          buffer_xml_append_printf
+             (buffer,
+              "</cve>"
+              "</max_epss>"
+              "</epss>");
+        }
+
       xml_string_append (buffer, close_tag ? "</nvt>" : "");
       msg = g_string_free (buffer, FALSE);
     }

src/manage.h

@@ -1171,9 +1171,6 @@ result_detection_reference (result_t, report_t, const char *, const char *,
 
 /* Reports. */
 
-/** @todo How is this documented? */
-#define OVAS_MANAGE_REPORT_ID_LENGTH UUID_LEN_STR
-
 /**
  * @brief Default apply_overrides setting
  */
@@ -1985,6 +1982,36 @@ nvt_iterator_solution_type (iterator_t*);
 const char*
 nvt_iterator_solution_method (iterator_t*);
 
+double
+nvt_iterator_epss_score (iterator_t*);
+
+double
+nvt_iterator_epss_percentile (iterator_t*);
+
+const char*
+nvt_iterator_epss_cve (iterator_t*);
+
+double
+nvt_iterator_epss_severity (iterator_t*);
+
+gboolean
+nvt_iterator_has_epss_severity (iterator_t*);
+
+double
+nvt_iterator_max_epss_score (iterator_t*);
+
+double
+nvt_iterator_max_epss_percentile (iterator_t*);
+
+const char*
+nvt_iterator_max_epss_cve (iterator_t*);
+
+double
+nvt_iterator_max_epss_severity (iterator_t*);
+
+gboolean
+nvt_iterator_has_max_epss_severity (iterator_t*);
+
 char*
 nvt_default_timeout (const char *);